Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2025-48881Highcom.ritense.valtimo:objecten-api: Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized usersCVE-2025-27526Mediumorg.apache.inlong:manager-pojo: Apache InLong: JDBC Vulnerability For URLEncode and backspace bypassCVE-2025-27528Mediumorg.apache.inlong:manager-pojo: Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File ReadCVE-2025-27522Highorg.apache.inlong:manager-pojo: Apache InLong: JDBC Vulnerability during verification processingCVE-2025-48382Loworg.codelibs.fess:fess: Fess has Insecure Temporary File PermissionsCVE-2025-4949Mediumorg.eclipse.jgit:org.eclipse.jgit: Eclipse JGit XML External Entity (XXE) VulnerabilityCVE-2025-48063Mediumorg.xwiki.platform:xwiki-platform-security-authorization-bridge: XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming rightCVE-2025-41232Criticalorg.springframework.security:spring-security-aspects: Spring Security authorization bypass for method security annotations on private methodsCVE-2025-22233Loworg.springframework:spring-context: Spring Framework DataBinder Case Sensitive Match ExceptionCVE-2025-47885Highorg.jenkins-ci.plugins:cloudbees-jenkins-advisor: Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site ScriptingCVE-2025-47889Highorg.jenkins-ci.plugins:wso2id-oauth: Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User CredentialsCVE-2025-47884Criticalio.jenkins.plugins:oidc-provider: Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID TokensCVE-2025-47886Mediumorg.jenkins-ci.plugins:vmanager-plugin: Jenkins Cadence vManager Plugin Vulnerable to Cross-Site Request ForgeryCVE-2025-47887Mediumorg.jenkins-ci.plugins:vmanager-plugin: Jenkins Cadence vManager Plugin is Missing Permission ChecksCVE-2025-47888Mediumio.jenkins.plugins:dingding-notifications: Jenkins DingTalk Plugin Unconditionally Disables SSL/TLS Certificate and Hostname ValidationCVE-2025-4641Criticalio.github.bonigarcia:webdrivermanager: BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity ReferenceCVE-2025-26864Mediumorg.apache.iotdb:node-commons: Apache IoTDB Discloses Sensitive Information via Log FilesCVE-2024-24780Criticalorg.apache.iotdb:iotdb-core: Apache IoTDB Vulnerable to Remote Code ExecutionCVE-2025-26795Mediumorg.apache.iotdb:iotdb-jdbc: Apache IoTDB JDBC Driver Discloses Sensitive Information via Log FilesCVE-2025-46392Lowcommons-configuration:commons-configuration: Apache Commons Configuration Uncontrolled Resource ConsumptionCVE-2025-1948Highorg.eclipse.jetty.http2:jetty-http2-common: Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequently the JVM to exitCVE-2024-13009Highorg.eclipse.jetty:jetty-server: **UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate requestCVE-2025-46551Mediumrubygems:jruby-openssl: JRuby-OpenSSL has hostname verification disabled by defaultCVE-2025-46827Highorg.graylog2:graylog2-server: Graylog Allows Session Takeover via Insufficient HTML SanitizationGHSA-Q9Q2-3PPX-MWQFHighorg.graylog2:graylog2-server: Graylog Allows Stored Cross-Site Scripting via Files Plugin and API Browser

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo